Export limit exceeded: 377487 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377487 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55421 | 2026-09-02 | 6.8 Medium | ||
| Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c. | ||||
| CVE-2026-53636 | 2026-09-02 | 4.7 Medium | ||
| Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85. | ||||
| CVE-2026-53635 | 2026-09-02 | 7.6 High | ||
| Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6. | ||||
| CVE-2026-59276 | 2 Spring, Vmware | 2 Spring Security, Spring Security | 2026-09-02 | 5.9 Medium |
| Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25 | ||||
| CVE-2026-73723 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Fabric Composer, Fabric Composer | 2026-09-02 | 7.1 High |
| A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform. | ||||
| CVE-2026-73724 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Fabric Composer, Fabric Composer | 2026-09-02 | 7.1 High |
| Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system. | ||||
| CVE-2026-73725 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Fabric Composer, Fabric Composer | 2026-09-02 | 7 High |
| A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges, leading to a complete compromise of the affected host. | ||||
| CVE-2026-73726 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Fabric Composer, Fabric Composer | 2026-09-02 | 6.8 Medium |
| A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjacent actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data. | ||||
| CVE-2026-73727 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Fabric Composer, Fabric Composer | 2026-09-02 | 6.5 Medium |
| Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A successful exploit allows an attacker to access data beyond what is authorized by the user's existing privilege level, which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer. | ||||
| CVE-2026-73728 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 6.5 Medium |
| Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service. | ||||
| CVE-2026-73731 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 6.1 Medium |
| A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. | ||||
| CVE-2026-73732 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 5.6 Medium |
| A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to obtain sensitive information. Successful exploitation could allow an attacker to retrieve sensitive data which could be used to gain further unauthorized access to the affected system and to other systems it interacts with. | ||||
| CVE-2026-73733 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 5.4 Medium |
| Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentication controls. Successful exploitation could allow an attacker to retain limited access to the affected system after that access should have been revoked. | ||||
| CVE-2026-73734 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 5.4 Medium |
| A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL. | ||||
| CVE-2026-73735 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 5.4 Medium |
| Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is authorized by the user's existing privilege level. | ||||
| CVE-2026-73736 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 5.3 Medium |
| A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory. | ||||
| CVE-2026-73737 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 4.8 Medium |
| An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations, if certain preconditions outside of the attacker's control are met. | ||||
| CVE-2026-73738 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 4.7 Medium |
| A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to view sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further privileges on the affected system. | ||||
| CVE-2026-73739 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 4.4 Medium |
| A vulnerability exists in the API of HPE Networking Fabric Composer that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve sensitive information that was expected to remain protected within the affected system. | ||||
| CVE-2026-73740 | 1 Hewlett Packard Enterprise (hpe) | 1 Fabric Composer | 2026-09-02 | 4.4 Medium |
| A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the affected system. | ||||